Is CVE-2026-73471 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73471 being exploited in the wild.

How severe is CVE-2026-73471?

Medium severity, with a CVSS score of 6.1, published 6 November 2026.

Which products and versions are affected?

Gstreamer Gst-Plugins-Good before 1.28.6.

Is there a fix for CVE-2026-73471?

Yes: fixed in gst-plugins-good 1.28.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73471 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-73471?

Check whether you run Gstreamer Gst-Plugins-Good at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73471: GStreamer gst-plugins-good out-of-bounds read in Nikon metadata parser

CVE-2026-73471 · Severity: medium · CVSS 6.1 · Published 2026-11-06

GStreamer is a multimedia framework that processes audio and video files. A flaw in the AVI file parser allows an attacker to craft a malicious AVI file that, when opened or previewed, causes the application to read memory outside its allocated buffer. This can result in application crashes or disclosure of sensitive information from memory.

Technologies: Gstreamer Gst-Plugins-Good. Vendors: Gstreamer.

Quick answers

Is CVE-2026-73471 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73471 being exploited in the wild.
How severe is CVE-2026-73471?: Medium severity, with a CVSS score of 6.1, published 6 November 2026.
Which products and versions are affected?: Gstreamer Gst-Plugins-Good before 1.28.6.
Is there a fix for CVE-2026-73471?: Yes: fixed in gst-plugins-good 1.28.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73471 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-73471?: Check whether you run Gstreamer Gst-Plugins-Good at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: gst-plugins-good 1.28.6

Technical details

An unverified pointer dereference in the Nikon metadata tag parser within GStreamer's avidemux component allows out-of-bounds reads when processing crafted AVI files. The vulnerability is triggered automatically when playbin, decodebin, or gst-discoverer auto-plugs avidemux to handle media files, requiring only user interaction to open or preview the malicious file. Exploitation can cause crashes or limited memory disclosure; a fix is available in gst-plugins-good 1.28.6.

Affected products

GStreamer gst-plugins-good before 1.28.6

Timeline

2026-11-06: advisory: GStreamer-SA-2026-0072 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.